@cmmd-center/forge 0.13.12 → 0.13.13

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -17358,7 +17358,8 @@ const ORCHESTRATION_WS_METHODS = {
 	getArchivedShellSnapshot: "orchestration.getArchivedShellSnapshot",
 	subscribeShell: "orchestration.subscribeShell",
 	subscribeThread: "orchestration.subscribeThread",
-	searchThreads: "orchestration.searchThreads"
+	searchThreads: "orchestration.searchThreads",
+	getThreadDetailPage: "orchestration.getThreadDetailPage"
 };
 const ProviderKind = Literals([
 	"codex",
@@ -17878,6 +17879,21 @@ Struct({
 	turnLimit: optionalKey(PositiveInt),
 	beforeCursor: optionalKey(TrimmedNonEmptyString)
 });
+/**
+* Reads one windowed page of a thread's detail directly over the RPC socket.
+*
+* The HTTP snapshot route and `subscribeThread`'s fallback snapshot both take
+* the same `turnLimit`/`beforeCursor` window, but neither can serve "load
+* earlier" on a connection with no HTTP endpoint: the fallback snapshot only
+* fires once, on subscribe. This method exists for exactly that case (a
+* relay-only connection), gated on the server's `threadDetailPageRpc`
+* capability so older servers are never sent a method they do not know.
+*/
+const OrchestrationGetThreadDetailPageInput = Struct({
+	threadId: ThreadId,
+	turnLimit: optionalKey(PositiveInt),
+	beforeCursor: optionalKey(TrimmedNonEmptyString)
+});
 const OrchestrationThreadDetailSnapshot = Struct({
 	snapshotSequence: NonNegativeInt,
 	thread: OrchestrationThread,
@@ -18842,6 +18858,10 @@ const OrchestrationRpcSchemas = {
 	searchThreads: {
 		input: OrchestrationSearchThreadsInput,
 		output: OrchestrationSearchThreadsResult
+	},
+	getThreadDetailPage: {
+		input: OrchestrationGetThreadDetailPageInput,
+		output: OrchestrationThreadDetailSnapshot
 	}
 };
 var OrchestrationGetSnapshotError = class extends TaggedErrorClass()("OrchestrationGetSnapshotError", {
@@ -22812,6 +22832,7 @@ const ServerConfig$1 = Struct({
 	shellRevealInFileManagerKind: optionalKey(FileManagerRevealKind),
 	threadResumeCompletionMarker: optionalKey(Boolean$1),
 	threadSnapshotPagination: optionalKey(Boolean$1),
+	threadDetailPageRpc: optionalKey(Boolean$1),
 	observability: ServerObservability,
 	settings: ServerSettings
 });
@@ -26678,6 +26699,17 @@ const WsOrchestrationSearchThreadsRpc = make$30(ORCHESTRATION_WS_METHODS.searchT
 	error: OrchestrationSearchThreadsError
 });
 /**
+* The socket-only path for "load earlier turns": a relay-only connection has
+* no HTTP endpoint, so this reads the same windowed page the HTTP snapshot
+* route and `subscribeThread`'s fallback snapshot serve, over the RPC socket
+* instead.
+*/
+const WsOrchestrationGetThreadDetailPageRpc = make$30(ORCHESTRATION_WS_METHODS.getThreadDetailPage, {
+	payload: OrchestrationRpcSchemas.getThreadDetailPage.input,
+	success: OrchestrationRpcSchemas.getThreadDetailPage.output,
+	error: OrchestrationGetSnapshotError
+});
+/**
 * Resolve `owner/repo` to the repository the caller is allowed to clone.
 *
 * Both of these run against the same CMMD-brokered GitHub credential the web
@@ -26790,7 +26822,7 @@ const WsRpcGroup = make$29(WsServerGetConfigRpc, WsServerRefreshProvidersRpc, Ws
 	payload: ProviderUploadFeedbackInput,
 	success: ProviderUploadFeedbackResult,
 	error: ProviderUploadFeedbackError
-}), WsOrchestrationSearchThreadsRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc);
+}), WsOrchestrationSearchThreadsRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsOrchestrationGetThreadDetailPageRpc);
 const RelayWsRpcGroup = WsRpcGroup.middleware(RelayAuthorizationMiddleware).middleware(RelayDeliveryMiddleware);
 /**
 * The direct-WebSocket mount of the same group, with per-method scope
@@ -26863,6 +26895,32 @@ function encodeCmmdRuntimeToolActivityPayload(kind, payload) {
 		}
 	};
 }
+const WORKTREE_LAUNCH_ACTIVITY_KINDS = new Set([
+	"worktree.requested",
+	"worktree.stage",
+	"worktree.output",
+	"worktree.created",
+	"worktree.failed",
+	"setup-script.requested",
+	"setup-script.started",
+	"setup-script.skipped",
+	"setup-script.failed",
+	"launch.agent-starting",
+	"launch.cancelled"
+]);
+function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
+	return {
+		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		forgeWorktreeLaunchActivity: {
+			schemaVersion: 1,
+			source: "native",
+			kind
+		}
+	};
+}
+function isCmmdRuntimeWorktreeLaunchActivityKind(kind) {
+	return WORKTREE_LAUNCH_ACTIVITY_KINDS.has(kind);
+}
 //#endregion
 //#region ../../packages/contracts/src/cmmdProjectPatch.ts
 const CMMD_PROJECT_PATCH_FIELDS = {
@@ -31965,6 +32023,11 @@ const RELAY_METHOD_POLICY_BASES = [
 		requiredScope: "thread.read",
 		deliveryClass: "subscription"
 	},
+	{
+		method: ORCHESTRATION_WS_METHODS.getThreadDetailPage,
+		requiredScope: "thread.read",
+		deliveryClass: "read"
+	},
 	{
 		method: WS_METHODS.assetsCreateUrl,
 		requiredScope: "thread.read",
@@ -50634,7 +50697,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53077,7 +53140,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53099,7 +53162,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66022,7 +66085,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.12";
+var version$1 = "0.13.13";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66424,6 +66487,129 @@ const respondToAuthError = (error) => gen(function* () {
 	}));
 	return response;
 });
+//#endregion
+//#region src/http/rateLimit.ts
+/**
+* Per-client, per-route-class rate limiting for Forge's own HTTP surface.
+*
+* Scoped to the routes a broken or looping client can hammer before it ever
+* has an authenticated session — the CMMD device-code poll, the bootstrap and
+* pairing-token exchanges — plus the authenticated /api/cmmd proxy, which
+* every desktop UI interaction runs through. None of these had any limit
+* before FOR-36706: a stuck pairing loop or a poll that never saw `slow_down`
+* could retry as fast as the network allowed, with nothing to stop it and
+* nothing telling the client to back off.
+*
+* Defaults are generous on purpose. This exists to bound a runaway client,
+* not to throttle a working one — see `defaultRateLimitPolicies` for the
+* reasoning behind each number and how to override it.
+*
+* Deliberately plain module state, not an Effect service: every route this
+* guards is a synchronous decision (count, compare, maybe reset a window),
+* and threading a new Context requirement through the whole server's layer
+* graph for that would touch every test file that stands up any of these
+* routes. `cmmdJwtResolver.ts`'s in-flight-refresh map is the same call.
+*/
+function envInt(name, fallback) {
+	const raw = process.env[name];
+	if (!raw) return fallback;
+	const parsed = Number(raw);
+	return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
+}
+/**
+* One reasoning line per class, so a future change to a default has to
+* confront why the old one was picked:
+*
+* - `auth-device-poll` (`/api/auth/cmmd-oauth/device` and `/token`): RFC 8628
+*   polls every `interval` seconds, 5 by default, so a well-behaved client
+*   sits under 12/min. 120/min leaves room for several concurrent sign-in
+*   attempts and CMMD's own `slow_down` handling without ever tripping on
+*   normal use, while still bounding a client that ignores `slow_down`.
+* - `auth-bootstrap` (`/api/auth/bootstrap*`, the bearer bootstrap routes):
+*   a working client bootstraps once per sign-in. 30/min is generous headroom
+*   for retries after a network blip, not a budget anyone should approach.
+* - `auth-token-exchange` (`/oauth/token`, the vendored pairing exchange):
+*   same shape as bootstrap — one pairing attempt, occasionally retried.
+* - `cmmd-proxy` (every `/api/cmmd/*` route): this is the one real desktop
+*   traffic actually leans on — task lists, project browsing, comments, all
+*   day. 1200/min (20/sec) is set high enough that no normal session should
+*   ever see it; it exists for a retry loop or a runaway resync, not for
+*   ordinary use.
+*/
+function buildPoliciesFromEnv() {
+	return {
+		"auth-device-poll": {
+			maxRequests: envInt("FORGE_RATE_LIMIT_AUTH_DEVICE_POLL_MAX", 120),
+			windowMs: envInt("FORGE_RATE_LIMIT_AUTH_DEVICE_POLL_WINDOW_SECONDS", 60) * 1e3
+		},
+		"auth-bootstrap": {
+			maxRequests: envInt("FORGE_RATE_LIMIT_AUTH_BOOTSTRAP_MAX", 30),
+			windowMs: envInt("FORGE_RATE_LIMIT_AUTH_BOOTSTRAP_WINDOW_SECONDS", 60) * 1e3
+		},
+		"auth-token-exchange": {
+			maxRequests: envInt("FORGE_RATE_LIMIT_AUTH_TOKEN_EXCHANGE_MAX", 30),
+			windowMs: envInt("FORGE_RATE_LIMIT_AUTH_TOKEN_EXCHANGE_WINDOW_SECONDS", 60) * 1e3
+		},
+		"cmmd-proxy": {
+			maxRequests: envInt("FORGE_RATE_LIMIT_CMMD_PROXY_MAX", 1200),
+			windowMs: envInt("FORGE_RATE_LIMIT_CMMD_PROXY_WINDOW_SECONDS", 60) * 1e3
+		}
+	};
+}
+let policies = buildPoliciesFromEnv();
+const windows = /* @__PURE__ */ new Map();
+function windowKey(routeClass, clientKey) {
+	return `${routeClass}\0${clientKey}`;
+}
+/**
+* Fixed-window counting: cheap, and precise enough for a loop-guard rather
+* than a security boundary. The one imprecision this trades away — up to 2x
+* the configured rate right at a window boundary — matters for an attacker
+* budgeting requests against the limiter's clock, not for the runaway
+* clients this exists to catch.
+*/
+function checkHttpRateLimit(input) {
+	const policy = policies[input.routeClass];
+	const nowMs = Date.now();
+	const key = windowKey(input.routeClass, input.clientKey);
+	const existing = windows.get(key);
+	const windowIsLive = existing !== void 0 && nowMs - existing.windowStartMs < policy.windowMs;
+	const windowStartMs = windowIsLive ? existing.windowStartMs : nowMs;
+	const count = (windowIsLive ? existing.count : 0) + 1;
+	windows.set(key, {
+		windowStartMs,
+		count
+	});
+	return {
+		allowed: count <= policy.maxRequests,
+		retryAfterSeconds: Math.max(0, Math.ceil((windowStartMs + policy.windowMs - nowMs) / 1e3))
+	};
+}
+/**
+* Checks the limiter for one request and, when the caller is over budget,
+* returns the 429 to send instead of running the route — `null` means
+* proceed. Every route this guards is expected to call this first and return
+* early on a non-null result, before doing any other work.
+*/
+function rateLimitOrRespond(input) {
+	const decision = checkHttpRateLimit(input);
+	if (decision.allowed) return null;
+	return jsonUnsafe({ error: "Too many requests. Try again later." }, {
+		status: 429,
+		headers: { "retry-after": String(decision.retryAfterSeconds) }
+	});
+}
+/**
+* The client identity for a route with no session yet — the device-code
+* poll, bootstrap and pairing-token exchange all run before Forge has issued
+* one. IP address is the only stable-enough signal available at that point;
+* the authenticated `/api/cmmd` proxy keys on the session instead (see its
+* call site), so one desktop and one phone sharing a NAT never share a
+* budget there.
+*/
+function clientKeyFromRequest(request) {
+	return normalizeIpAddress(getOrNull(request.remoteAddress)) ?? "unknown";
+}
 const OAUTH_ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
 /**
 * The one exchange this endpoint performs, or the reason it will not.
@@ -68271,6 +68457,11 @@ function commandOAuthProxyStatus(path, status, body) {
 }
 const authBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap", gen(function* () {
 	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const sessions = yield* SessionCredentialService;
 	const payload = yield* schemaBodyJson(AuthBootstrapInput).pipe(mapError((cause) => new AuthError({
@@ -68288,6 +68479,11 @@ const authBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap", gen(functio
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const authCommandBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/command", gen(function* () {
 	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const sessions = yield* SessionCredentialService;
 	if (serverAuth.isForgeCloudShell?.() === true) return yield* new AuthError({
@@ -68336,6 +68532,11 @@ const authCommandBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/comman
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/command/bearer", gen(function* () {
 	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const sessions = yield* SessionCredentialService;
 	if (serverAuth.isForgeCloudShell?.() === true) return yield* new AuthError({
@@ -68384,6 +68585,11 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	}, { status: 200 });
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const authCmmdOAuthDeviceRouteLayer = add$1("POST", "/api/auth/cmmd-oauth/device", gen(function* () {
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-device-poll",
+		clientKey: clientKeyFromRequest(yield* HttpServerRequest)
+	});
+	if (limited) return limited;
 	const payload = yield* schemaBodyJson(CommandOAuthDeviceInput).pipe(mapError((cause) => new AuthError({
 		message: "Invalid CMMD OAuth device payload.",
 		status: 400,
@@ -68395,7 +68601,17 @@ const authCmmdOAuthDeviceRouteLayer = add$1("POST", "/api/auth/cmmd-oauth/device
 		...payload.scope ? { scope: payload.scope } : {}
 	});
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* The device-code poll. Called every `interval` seconds by design (RFC
+* 8628), which is exactly why FOR-36706 puts a limiter on it: a client that
+* ignores `slow_down` — a bug, not a person — has no other backstop here.
+*/
 const authCmmdOAuthTokenRouteLayer = add$1("POST", "/api/auth/cmmd-oauth/token", gen(function* () {
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-device-poll",
+		clientKey: clientKeyFromRequest(yield* HttpServerRequest)
+	});
+	if (limited) return limited;
 	const payload = yield* schemaBodyJson(CommandOAuthTokenInput).pipe(mapError((cause) => new AuthError({
 		message: "Invalid CMMD OAuth token payload.",
 		status: 400,
@@ -68690,6 +68906,11 @@ const authWebCallbackRouteLayer = add$1("GET", "/api/auth/callback", gen(functio
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const authBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/bearer", gen(function* () {
 	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const payload = yield* schemaBodyJson(AuthBootstrapInput).pipe(mapError((cause) => new AuthError({
 		message: "Invalid bootstrap payload.",
@@ -68721,6 +68942,11 @@ const authBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/bearer"
 */
 const authOAuthTokenExchangeRouteLayer = add$1("POST", "/oauth/token", gen(function* () {
 	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-token-exchange",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const payload = yield* schemaBodyUrlParams(OAuthTokenExchangeInput).pipe(mapError((cause) => new AuthError({
 		message: "Invalid token exchange payload.",
@@ -70923,9 +71149,12 @@ function trySubjectFallback(sessionId, subject, logPrefix) {
 * Fail-closed: never returns a non-user / malformed Bearer. Callers must map
 * null to CMMD_AUTH_REQUIRED and must not call CMMD upstream with a bad token.
 */
-function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth", forceRefresh = false }) {
+function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth", forceRefresh = false, staleAccessToken = null }) {
 	const cached = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
-	if (!forceRefresh && cached && !isJwtExpiredForSession(sessionId)) return succeed(cached);
+	if (cached && !isJwtExpiredForSession(sessionId)) {
+		if (!forceRefresh) return succeed(cached);
+		if (staleAccessToken && cached !== staleAccessToken) return succeed(cached);
+	}
 	const normalizedSubject = subject?.trim() || null;
 	if (!normalizedSubject && !forceRefresh) return succeed(null);
 	return gen(function* () {
@@ -71762,6 +71991,11 @@ function buildProxyRouteLayer(route) {
 	const handler = gen(function* () {
 		const req = yield* HttpServerRequest;
 		const session = yield* (yield* ServerAuth).authenticateHttpRequest(req);
+		const limited = rateLimitOrRespond({
+			routeClass: "cmmd-proxy",
+			clientKey: session.sessionId
+		});
+		if (limited) return limited;
 		const pathParams = yield* params;
 		const cmmdPath = substitutePath(route.cmmdPath, pathParams);
 		if (!cmmdPath) return jsonUnsafe({ error: "Missing required path parameter." }, { status: 400 });
@@ -71821,6 +72055,11 @@ function buildProxyHandlerEffect(route) {
 	return gen(function* () {
 		const req = yield* HttpServerRequest;
 		const session = yield* (yield* ServerAuth).authenticateHttpRequest(req);
+		const limited = rateLimitOrRespond({
+			routeClass: "cmmd-proxy",
+			clientKey: session.sessionId
+		});
+		if (limited) return limited;
 		if (!readCommandAccessTokenForSession(session.sessionId)) return yield* respondCmmdConnectionRequired(session.sessionId);
 		const parsed = yield* route.parse(req);
 		if (!parsed.ok) return jsonUnsafe(parsed.body, { status: parsed.status });
@@ -75459,7 +75698,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75467,8 +75706,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93650,7 +93889,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-D8mGyWmt.mjs"),
+		try: () => import("./open-FIgTDosf.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -97647,6 +97886,26 @@ function serializeNativeToolActivity(activity) {
 		}
 	};
 }
+function serializeWorktreeLaunchActivity(activity) {
+	if (decodeWorktreeLaunchActivityKind(activity.kind) === null) return null;
+	const summary = text(activity.summary, 4e3);
+	if (summary === null) return null;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			...eventTurn(activity.turnId),
+			kind: "tool_call",
+			summary,
+			status: "completed",
+			payload: encodeCmmdRuntimeWorktreeLaunchActivityPayload(activity.kind, activity.payload)
+		}
+	};
+}
+function decodeWorktreeLaunchActivityKind(kind) {
+	return isCmmdRuntimeWorktreeLaunchActivityKind(kind) ? kind : null;
+}
 function isReplicatedFailureActivity(activity) {
 	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
@@ -98027,12 +98286,17 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializeNativeToolActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const worktreeLaunchActivities = thread.activities.flatMap((activity) => {
+		const event = serializeWorktreeLaunchActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	return [
 		...messages,
 		...replicaActivities,
 		...toolActivities,
+		...worktreeLaunchActivities,
 		...failureActivities,
 		...recordedTurns,
 		...textGenerations
@@ -106186,6 +106450,39 @@ function loadInitialShellSnapshot(input) {
 		return yield* input.projectionSnapshotQuery.getShellSnapshot();
 	});
 }
+/**
+* The thread snapshot a subscription falls back to, windowed when the
+* subscriber asked for a window. A missing thread is a failure rather than an
+* empty snapshot: the subscriber asked about a thread this server does not
+* have, and saying so is the only honest answer.
+*
+* Also the read behind `getThreadDetailPage`, the socket RPC a relay-only
+* connection uses for "load earlier turns" in place of the HTTP snapshot
+* route: same window, same pure `windowThreadDetail`, so the two reads cannot
+* disagree about what a page is.
+*/
+function loadThreadDetailSnapshot(input) {
+	return gen(function* () {
+		const [threadDetail, snapshotSequence] = yield* all([input.projectionSnapshotQuery.getThreadDetailById(input.threadId).pipe(mapError((cause) => new OrchestrationGetSnapshotError({
+			message: `Failed to load thread ${input.threadId}`,
+			cause
+		}))), input.orchestrationEngine.getReadModel().pipe(map$3((readModel) => readModel.snapshotSequence))]);
+		if (isNone(threadDetail)) return yield* new OrchestrationGetSnapshotError({
+			message: `Thread ${input.threadId} was not found`,
+			cause: input.threadId
+		});
+		const windowed = windowThreadDetail({
+			thread: threadDetail.value,
+			window: input.window,
+			snapshotSequence
+		});
+		return {
+			snapshotSequence,
+			thread: windowed.thread,
+			...windowed.page === void 0 ? {} : { page: windowed.page }
+		};
+	});
+}
 function makeSnapshotThenLiveStream(input) {
 	return unwrap$1(gen(function* () {
 		const liveEvents = yield* input.subscribeLiveEvents;
@@ -106411,32 +106708,6 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 		}, normalizedCommand) : (normalizedCommand.type === "thread.turn.interrupt" ? interruptBootstrapTurnStart(orchestrationEngine, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand)).pipe(mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 		return startup.enqueueCommand(dispatchEffect).pipe(mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 	};
-	/**
-	* The thread snapshot a subscription falls back to, windowed when the
-	* subscriber asked for a window. A missing thread is a failure rather
-	* than an empty snapshot: the subscriber asked about a thread this server
-	* does not have, and saying so is the only honest answer.
-	*/
-	const loadThreadDetailSnapshot = (threadId, turnLimit) => gen(function* () {
-		const [threadDetail, snapshotSequence] = yield* all([projectionSnapshotQuery.getThreadDetailById(threadId).pipe(mapError((cause) => new OrchestrationGetSnapshotError({
-			message: `Failed to load thread ${threadId}`,
-			cause
-		}))), orchestrationEngine.getReadModel().pipe(map$3((readModel) => readModel.snapshotSequence))]);
-		if (isNone(threadDetail)) return yield* new OrchestrationGetSnapshotError({
-			message: `Thread ${threadId} was not found`,
-			cause: threadId
-		});
-		const windowed = windowThreadDetail({
-			thread: threadDetail.value,
-			window: turnLimit === void 0 ? {} : { turnLimit },
-			snapshotSequence
-		});
-		return {
-			snapshotSequence,
-			thread: windowed.thread,
-			...windowed.page === void 0 ? {} : { page: windowed.page }
-		};
-	});
 	const loadServerConfig = gen(function* () {
 		const keybindingsConfig = yield* keybindings.loadConfigState;
 		const providers = yield* providerRegistry.getProviders;
@@ -106460,6 +106731,7 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 			},
 			threadResumeCompletionMarker: true,
 			threadSnapshotPagination: true,
+			threadDetailPageRpc: true,
 			observability: {
 				logsDirectoryPath: config.logsDir,
 				localTracingEnabled: true,
@@ -106560,12 +106832,26 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 		[ORCHESTRATION_WS_METHODS.subscribeThread]: (input) => observeRpcStreamEffect(ORCHESTRATION_WS_METHODS.subscribeThread, succeed(makeThreadSubscriptionStream(input, {
 			subscribeLiveEvents: orchestrationEngine.subscribeDomainEvents().pipe(map$3((events) => events.pipe(filter$2(isThreadDetailEventFor(input.threadId))))),
 			currentSequence: orchestrationEngine.getReadModel().pipe(map$3((readModel) => readModel.snapshotSequence)),
-			loadSnapshot: loadThreadDetailSnapshot(input.threadId, input.turnLimit),
+			loadSnapshot: loadThreadDetailSnapshot({
+				threadId: input.threadId,
+				window: input.turnLimit === void 0 ? {} : { turnLimit: input.turnLimit },
+				projectionSnapshotQuery,
+				orchestrationEngine
+			}),
 			replayEvents: (afterSequence) => orchestrationEngine.readEvents(afterSequence).pipe(filter$2(isThreadDetailEventFor(input.threadId)), mapError$1((cause) => new OrchestrationGetSnapshotError({
 				message: `Failed to replay thread ${input.threadId}`,
 				cause
 			})))
 		})), { "rpc.aggregate": "orchestration" }),
+		[ORCHESTRATION_WS_METHODS.getThreadDetailPage]: (input) => observeRpcEffect(ORCHESTRATION_WS_METHODS.getThreadDetailPage, loadThreadDetailSnapshot({
+			threadId: input.threadId,
+			window: {
+				...input.turnLimit === void 0 ? {} : { turnLimit: input.turnLimit },
+				...input.beforeCursor === void 0 ? {} : { beforeCursor: input.beforeCursor }
+			},
+			projectionSnapshotQuery,
+			orchestrationEngine
+		}), { "rpc.aggregate": "orchestration" }),
 		[WS_METHODS.serverGetConfig]: (_input) => observeRpcEffect(WS_METHODS.serverGetConfig, loadServerConfig, { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverRefreshProviders]: (_input) => observeRpcEffect(WS_METHODS.serverRefreshProviders, providerRegistry.refresh().pipe(map$3((providers) => ({ providers }))), { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverStartProviderAuth]: (input) => observeRpcEffect(WS_METHODS.serverStartProviderAuth, gen(function* () {
@@ -190966,7 +191252,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -201166,12 +201452,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -201186,7 +201472,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -201197,14 +201483,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -201219,7 +201505,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -201234,13 +201520,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -212612,6 +212898,8 @@ const PUBLIC_PROVIDER_LEAK_PATTERNS = [
 	/\bCURSOR_API_KEY\b/,
 	/\bOPENCODE_API_KEY\b/,
 	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
+	/\bProviderValidationError\b/,
+	/\/forge-server\/node_modules\//,
 	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
 	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
 ];
@@ -212621,6 +212909,12 @@ function isProviderRateOrQuotaError(message) {
 	const normalized = message.toLowerCase();
 	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
 }
+function providerLifecycleOrAccountCopy(message) {
+	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
+	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
+	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
+	return null;
+}
 /**
 * Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
 *
@@ -212633,7 +212927,8 @@ function isProviderRateOrQuotaError(message) {
 function categorizePublicProviderError(message) {
 	if (!message) return null;
 	const m = message.toLowerCase();
-	if (/\bforge_runtime_stopped\b/.test(m) || /\bthis turn was interrupted because the environment was stopped\b/.test(m)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
+	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
+	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
 	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
 	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
 	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
@@ -212813,13 +213108,20 @@ function claudeConfigDirectory(env) {
 		return null;
 	}
 }
-/** The fallback is allowed only for the exact credential bytes CMMD signed. */
-function primaryClaudeCredentialMatchesRevision(env, revision) {
+/**
+* The fallback is allowed only when the primary on-disk credential is
+* byte-identical to what CMMD prepared for the selected account. A ticket's
+* `credentialRevisionHash` cannot express that: it hashes the encrypted row
+* CMMD stores, not the decrypted bytes this process ever sees. Comparing
+* files directly is the only check that means what the fallback needs.
+*/
+function primaryClaudeCredentialMatchesPrepared(env, preparedDirectory) {
 	const directory = claudeConfigDirectory(env);
-	if (!directory || !/^[a-f0-9]{64}$/.test(revision)) return false;
+	if (!directory) return false;
 	try {
-		const credential = readFileSync(join(directory, CLAUDE_CREDENTIAL_FILE_NAME), "utf8");
-		return createHash("sha256").update(credential).digest("hex") === revision && hasAccessToken(JSON.parse(credential));
+		const primary = readFileSync(join(directory, CLAUDE_CREDENTIAL_FILE_NAME), "utf8");
+		const prepared = readFileSync(join(preparedDirectory, CLAUDE_CREDENTIAL_FILE_NAME), "utf8");
+		return hasAccessToken(JSON.parse(primary)) && createHash("sha256").update(primary).digest("hex") === createHash("sha256").update(prepared).digest("hex");
 	} catch {
 		return false;
 	}
@@ -217344,7 +217646,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			baseDir: serverConfig.baseDir,
 			accountIdentity: selectedAccountIdentity,
 			probeSupport: claudeCredentialDirectoryProbeFor(claudeBinaryPath).support,
-			primaryCredentialMatchesSelected: preparedCredential?.accountKind === "primary" && primaryClaudeCredentialMatchesRevision(process.env, preparedCredential.credentialRevisionHash)
+			primaryCredentialMatchesSelected: preparedCredential?.accountKind === "primary" && primaryClaudeCredentialMatchesPrepared(process.env, preparedCredential.directory)
 		});
 		if (credentialDirectoryDecision.outcome === "refused") return yield* new ProviderAdapterValidationError({
 			provider: PROVIDER$11,
@@ -232483,7 +232785,7 @@ async function acquireSelectedClaudeCredential(expected, transport) {
 		const claims = token === null ? null : verifyCmmdClaudeSelectedTicket(token, expected);
 		if (!token || !claims) throw new Error("invalid_ticket");
 		const credentialJson = await transport.readCredential(token);
-		if (Buffer.byteLength(credentialJson, "utf8") > 512e3 || createHash("sha256").update(credentialJson).digest("hex") !== claims.credentialRevisionHash || !hasUsableClaudeCredentialBlob(credentialJson)) throw new Error("invalid_credential");
+		if (Buffer.byteLength(credentialJson, "utf8") > 512e3 || !hasUsableClaudeCredentialBlob(credentialJson)) throw new Error("invalid_credential");
 		return {
 			claims,
 			credentialJson
@@ -268449,7 +268751,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -268580,14 +268882,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -268595,7 +268897,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -291649,6 +291951,10 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				shouldRestartForAccountChange,
 				hasResumeCursor: resumeCursor !== void 0
 			});
+			if (shouldRestartForAccountChange) yield* providerService.stopSession({
+				threadId,
+				preserveResumeState: true
+			});
 			const restartedSession = yield* startProviderSession(resumeCursor !== void 0 ? { resumeCursor } : void 0);
 			yield* logInfo("provider command reactor restarted provider session", {
 				threadId,
@@ -297584,7 +297890,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "e51896589531a57a458ca5c2430dfd54cdc16476";
+	return "81ce9360f406bcb5ae9fbdc9f90dd55d33f25f0c";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -298997,20 +299303,20 @@ const generatePairingToken = () => {
 	const randomBytes = crypto.getRandomValues(new Uint8Array(PAIRING_TOKEN_LENGTH));
 	return Array.from(randomBytes, (value) => PAIRING_TOKEN_ALPHABET[value & 31]).join("");
 };
+const invalidBootstrapCredentialError = (message) => new BootstrapCredentialError({
+	message,
+	status: 401
+});
+const internalBootstrapCredentialError = (message, cause) => new BootstrapCredentialError({
+	message,
+	status: 500,
+	cause
+});
 const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(function* () {
 	const config = yield* ServerConfig;
 	const pairingLinks = yield* AuthPairingLinkRepository;
 	const seededGrantsRef = yield* make$50(/* @__PURE__ */ new Map());
 	const changesPubSub = yield* unbounded$1();
-	const invalidBootstrapCredentialError = (message) => new BootstrapCredentialError({
-		message,
-		status: 401
-	});
-	const internalBootstrapCredentialError = (message, cause) => new BootstrapCredentialError({
-		message,
-		status: 500,
-		cause
-	});
 	const seedGrant = (credential, grant) => update$4(seededGrantsRef, (current) => {
 		const next = new Map(current);
 		next.set(credential, grant);
@@ -299025,19 +299331,19 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 		id
 	}).pipe(asVoid);
 	if (config.desktopBootstrapToken) {
-		const now$2 = yield* now;
+		const now$3 = yield* now;
 		yield* seedGrant(config.desktopBootstrapToken, {
 			method: "desktop-bootstrap",
 			role: "owner",
 			subject: "desktop-bootstrap",
-			expiresAt: add$3(now$2, { milliseconds: toMillis(DESKTOP_BOOTSTRAP_TOKEN_TTL) }),
+			expiresAt: add$3(now$3, { milliseconds: toMillis(DESKTOP_BOOTSTRAP_TOKEN_TTL) }),
 			remainingUses: "unbounded"
 		});
 	}
 	const toBootstrapCredentialError = (message) => (cause) => internalBootstrapCredentialError(message, cause);
 	const listActive = () => gen(function* () {
-		const now$5 = yield* now;
-		return (yield* pairingLinks.listActive({ now: now$5 })).map((row) => row.label ? {
+		const now$2 = yield* now;
+		return (yield* pairingLinks.listActive({ now: now$2 })).map((row) => row.label ? {
 			id: row.id,
 			credential: row.credential,
 			role: row.role,
@@ -299067,8 +299373,8 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 		const id = crypto.randomUUID();
 		const credential = generatePairingToken();
 		const ttl = input?.ttl ?? DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES;
-		const now$4 = yield* now;
-		const expiresAt = add$3(now$4, { milliseconds: toMillis(ttl) });
+		const now$5 = yield* now;
+		const expiresAt = add$3(now$5, { milliseconds: toMillis(ttl) });
 		const issued = {
 			id,
 			credential,
@@ -299082,7 +299388,7 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 			role: input?.role ?? "client",
 			subject: input?.subject ?? "one-time-token",
 			label: input?.label ?? null,
-			createdAt: now$4,
+			createdAt: now$5,
 			expiresAt
 		});
 		yield* emitUpsert({
@@ -299091,13 +299397,13 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 			role: input?.role ?? "client",
 			subject: input?.subject ?? "one-time-token",
 			...input?.label ? { label: input.label } : {},
-			createdAt: now$4,
+			createdAt: now$5,
 			expiresAt
 		});
 		return issued;
 	}).pipe(mapError(toBootstrapCredentialError("Failed to issue pairing credential.")));
 	const consume = (credential) => gen(function* () {
-		const now$3 = yield* now;
+		const now$4 = yield* now;
 		const seededResult = yield* modify$3(seededGrantsRef, (current) => {
 			const grant = current.get(credential);
 			if (!grant) return [{
@@ -299106,7 +299412,7 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 				error: invalidBootstrapCredentialError("Unknown bootstrap credential.")
 			}, current];
 			const next = new Map(current);
-			if (isGreaterThanOrEqualTo$1(now$3, grant.expiresAt)) {
+			if (isGreaterThanOrEqualTo$1(now$4, grant.expiresAt)) {
 				next.delete(credential);
 				return [{
 					_tag: "error",
@@ -299135,8 +299441,8 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 		if (seededResult.reason !== "not-found") return yield* seededResult.error;
 		const consumed = yield* pairingLinks.consumeAvailable({
 			credential,
-			consumedAt: now$3,
-			now: now$3
+			consumedAt: now$4,
+			now: now$4
 		});
 		if (isSome(consumed)) {
 			yield* emitRemoved(consumed.value.id);
@@ -299152,9 +299458,9 @@ const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(fu
 		if (isNone(matching)) return yield* invalidBootstrapCredentialError("Unknown bootstrap credential.");
 		if (matching.value.revokedAt !== null) return yield* invalidBootstrapCredentialError("Bootstrap credential is no longer available.");
 		if (matching.value.consumedAt !== null) return yield* invalidBootstrapCredentialError("Unknown bootstrap credential.");
-		if (isGreaterThanOrEqualTo$1(now$3, matching.value.expiresAt)) return yield* invalidBootstrapCredentialError("Bootstrap credential expired.");
+		if (isGreaterThanOrEqualTo$1(now$4, matching.value.expiresAt)) return yield* invalidBootstrapCredentialError("Bootstrap credential expired.");
 		return yield* invalidBootstrapCredentialError("Bootstrap credential is no longer available.");
-	}).pipe(mapError((cause) => cause instanceof BootstrapCredentialError ? cause : internalBootstrapCredentialError("Failed to consume bootstrap credential.", cause)));
+	}).pipe(mapError((cause) => cause instanceof BootstrapCredentialError ? cause : internalBootstrapCredentialError("Failed to consume bootstrap credential.", cause)), tapError((error) => error.status === 401 ? logWarning$1("Rejected bootstrap credential exchange.", { reason: error.message }) : void_$1));
 	return {
 		issueOneTimeToken,
 		listActive,
@@ -299209,6 +299515,10 @@ const SetAuthSessionLastConnectedAtInput = Struct({
 	sessionId: AuthSessionId,
 	lastConnectedAt: DateTimeUtcFromString
 });
+const ExtendAuthSessionExpiryInput = Struct({
+	sessionId: AuthSessionId,
+	expiresAt: DateTimeUtcFromString
+});
 var AuthSessionRepository = class extends Service$1()("forge/persistence/Services/AuthSessions/AuthSessionRepository") {};
 //#endregion
 //#region src/persistence/Layers/AuthSessions.ts
@@ -299360,6 +299670,17 @@ const AuthSessionRepositoryLive = effect(AuthSessionRepository, gen(function* ()
         WHERE session_id = ${sessionId}
           AND revoked_at IS NULL
         RETURNING session_id AS "sessionId"
+      `
+	});
+	const extendSessionExpiryRows = findAll({
+		Request: ExtendAuthSessionExpiryInput,
+		Result: Struct({ sessionId: AuthSessionId }),
+		execute: ({ sessionId, expiresAt }) => sql`
+        UPDATE auth_sessions
+        SET expires_at = ${expiresAt}
+        WHERE session_id = ${sessionId}
+          AND revoked_at IS NULL
+        RETURNING session_id AS "sessionId"
       `
 	});
 	const revokeOtherSessionRows = findAll({
@@ -299382,13 +299703,15 @@ const AuthSessionRepositoryLive = effect(AuthSessionRepository, gen(function* ()
 	const revoke = (input) => revokeSessionRows(input).pipe(mapError(toPersistenceSqlOrDecodeError$3("AuthSessionRepository.revoke:query", "AuthSessionRepository.revoke:decodeRows")), map$3((rows) => rows.length > 0));
 	const revokeAllExcept = (input) => revokeOtherSessionRows(input).pipe(mapError(toPersistenceSqlOrDecodeError$3("AuthSessionRepository.revokeAllExcept:query", "AuthSessionRepository.revokeAllExcept:decodeRows")), map$3((rows) => rows.map((row) => row.sessionId)));
 	const setLastConnectedAt = (input) => setLastConnectedAtRow(input).pipe(mapError(toPersistenceSqlOrDecodeError$3("AuthSessionRepository.setLastConnectedAt:query", "AuthSessionRepository.setLastConnectedAt:encodeRequest")));
+	const extendExpiry = (input) => extendSessionExpiryRows(input).pipe(mapError(toPersistenceSqlOrDecodeError$3("AuthSessionRepository.extendExpiry:query", "AuthSessionRepository.extendExpiry:decodeRows")), map$3((rows) => rows.length > 0));
 	return {
 		create,
 		getById,
 		listActive,
 		revoke,
 		revokeAllExcept,
-		setLastConnectedAt
+		setLastConnectedAt,
+		extendExpiry
 	};
 }));
 //#endregion
@@ -299396,6 +299719,20 @@ const AuthSessionRepositoryLive = effect(AuthSessionRepository, gen(function* ()
 const SIGNING_SECRET_NAME = "server-signing-key";
 const DEFAULT_SESSION_TTL = days(30);
 const DEFAULT_WEBSOCKET_TOKEN_TTL = minutes(5);
+/**
+* Whether a session presented at `nowMs` has used up half its own lifetime.
+*
+* A phone that opens the app daily should never hit the 30-day wall, but a
+* lost phone's session should still die on schedule if it is never presented
+* again. Sliding the expiry forward only when the session is already more
+* than half spent gives an active phone many chances to renew before expiry
+* while keeping a dormant session's remaining lifetime bounded by the last
+* time it was actually used.
+*/
+function isPastHalfLife(input) {
+	const halfLifeMarkMs = input.issuedAtMs + (input.expiresAtMs - input.issuedAtMs) / 2;
+	return input.nowMs >= halfLifeMarkMs;
+}
 const toSessionCredentialError = (message) => (cause) => new SessionCredentialError({
 	message,
 	cause
@@ -299556,6 +299893,42 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 			role: claims.role
 		};
 	}).pipe(mapError(toSessionCredentialError("Failed to issue session credential.")));
+	/**
+	* Slide a session's expiry forward when the token it just verified is past
+	* half its own lifetime, so a phone that keeps using the app never runs
+	* into the 30-day wall.
+	*
+	* The session id, subject, role and method carry over unchanged — only the
+	* signature-bearing `iat`/`exp` differ — which is what lets the DB row be
+	* extended in place (`extendExpiry`) rather than replaced: everything keyed
+	* by session id, most importantly the `command_access_tokens` row holding
+	* this session's CMMD credential, needs no migration.
+	*/
+	const renewIfPastHalfLife = (input) => gen(function* () {
+		const nowMs = yield* currentTimeMillis;
+		if (!isPastHalfLife({
+			issuedAtMs: input.row.issuedAt.epochMilliseconds,
+			expiresAtMs: input.row.expiresAt.epochMilliseconds,
+			nowMs
+		})) return void 0;
+		const newIssuedAt = yield* now;
+		const newExpiresAt = add$3(newIssuedAt, { milliseconds: toMillis(DEFAULT_SESSION_TTL) });
+		const newClaims = {
+			...input.claims,
+			iat: newIssuedAt.epochMilliseconds,
+			exp: newExpiresAt.epochMilliseconds
+		};
+		const newEncodedPayload = base64UrlEncode(JSON.stringify(newClaims));
+		const newSignature = signPayload(newEncodedPayload, signingSecret);
+		if (!(yield* authSessions.extendExpiry({
+			sessionId: input.claims.sid,
+			expiresAt: newExpiresAt
+		}).pipe(orElseSucceed(() => false)))) return void 0;
+		return {
+			token: `${newEncodedPayload}.${newSignature}`,
+			expiresAt: newExpiresAt
+		};
+	});
 	const verify = (token) => gen(function* () {
 		const [encodedPayload, signature] = token.split(".");
 		if (!encodedPayload || !signature) return yield* new SessionCredentialError({ message: "Malformed session token." });
@@ -299570,14 +299943,19 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 		if (isSome(row)) {
 			if (row.value.revokedAt !== null) return yield* new SessionCredentialError({ message: "Session token revoked." });
 		} else if (!(statelessCookieSessions && claims.method === "browser-session-cookie")) return yield* new SessionCredentialError({ message: "Unknown session token." });
+		const renewed = isSome(row) ? yield* renewIfPastHalfLife({
+			claims,
+			row: row.value
+		}) : void 0;
 		return {
 			sessionId: claims.sid,
 			token,
 			method: claims.method,
 			client: isSome(row) ? toClientMetadata(row.value.client) : createDefaultClientMetadata(),
-			expiresAt: makeUnsafe$5(claims.exp),
+			expiresAt: renewed?.expiresAt ?? makeUnsafe$5(claims.exp),
 			subject: claims.sub,
-			role: claims.role
+			role: claims.role,
+			...renewed ? { renewed } : {}
 		};
 	}).pipe(mapError((cause) => cause instanceof SessionCredentialError ? cause : new SessionCredentialError({
 		message: "Failed to verify session credential.",
@@ -300069,7 +300447,10 @@ const ServerAuthLive = effect(ServerAuth, gen(function* () {
 		subject: session.subject,
 		method: session.method,
 		role: session.role,
-		...session.expiresAt ? { expiresAt: session.expiresAt } : {}
+		...session.renewed ? {
+			expiresAt: session.renewed.expiresAt,
+			renewedSessionToken: session.renewed.token
+		} : session.expiresAt ? { expiresAt: session.expiresAt } : {}
 	})), mapError((cause) => new AuthError({
 		message: "Unauthorized request.",
 		status: 401,
@@ -300104,6 +300485,7 @@ const ServerAuthLive = effect(ServerAuth, gen(function* () {
 		role: session.role,
 		sessionMethod: session.method,
 		...session.expiresAt ? { expiresAt: toUtc(session.expiresAt) } : {},
+		...session.renewedSessionToken ? { renewedSessionToken: session.renewedSessionToken } : {},
 		cmmdIdentity
 	})))), tapError((e) => {
 		if (e._tag === "AuthError" && (e.status ?? 500) < 500) return void_$1;
@@ -318374,7 +318756,7 @@ function makeProjectLeadControllerClientLive(options = {}) {
 		const sql = yield* SqlClient;
 		const fetchFn = options.fetchFn ?? fetch;
 		const baseUrl = options.baseUrl ?? resolveCommandAppUrl();
-		const resolveStoredJwt = (forceRefresh) => gen(function* () {
+		const resolveStoredJwt = (forceRefresh, staleJwt) => gen(function* () {
 			const owner = yield* readMostRecentOwnerCommandAuthSession.pipe(provideService(SqlClient, sql), mapError((cause) => new ProjectLeadControllerClientError({
 				kind: "unavailable",
 				operation: "resolve-owner-session",
@@ -318388,7 +318770,8 @@ function makeProjectLeadControllerClientLive(options = {}) {
 				sessionId: owner.sessionId,
 				subject: owner.subject,
 				logPrefix: "project-lead-scheduler",
-				forceRefresh
+				forceRefresh,
+				staleAccessToken: staleJwt
 			}).pipe(provideService(SqlClient, sql));
 			if (!jwt) return yield* new ProjectLeadControllerClientError({
 				kind: "unauthenticated",
@@ -318431,7 +318814,7 @@ function makeProjectLeadControllerClientLive(options = {}) {
 			}));
 			if (first._tag === "Success") return first.success;
 			if (first.failure.kind !== "unauthenticated") return yield* first.failure;
-			const refreshed = yield* resolveJwt(true);
+			const refreshed = yield* resolveJwt(true, jwt);
 			return yield* requestAttempt({
 				...input,
 				jwt: refreshed
@@ -321836,7 +322219,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-D8mGyWmt.mjs")).default;
+			const open = (await import("./open-FIgTDosf.mjs")).default;
 			await open(url);
 			return true;
 		},